Contents

Mobile-originated call

A call originating from a mobile device (MS) in the GSM network is routed through the core network to the destination party. To connect to the GSM network, an MS first connects to a radio network, which is in charge of handling messaging between devices and the core network. An MS is constantly communicating with the Base Station Subsystem of the radio network to send and receive signals. The steps to establishing a GSM voice call are illustrated below.

to initiate a call, the MS sends a request for radio resource allocation to the BSS, which mediates further connection to the Mobile Switching Center (MSC). The BSS assigns the MS a channel with a given frequency and time slot, which constitutes the communication route between the MS and the BSS.

once the MS confirms the established channel, the BSS can initiate the connection to the MSC.

once the MS has connected to the network, the subscriber needs to be authenticated. This can be done using the IMSI number stored in the SIM card, which allows the Authentication Center in the core network to verify the subscriber's identity. After this step, the MS and the MSC can start communicating.

To make sure the data sent over the radio network between the BSS and MS/MSC is secure, the MSC initiates a ciphering procedure which is transmitted to the BTS, which in turn forwards the message to the MS. The MS enables ciphering towards the BTS; as the BTS starts receiving ciphered data, it will start the ciphered transmission of information, finalizing the encryption procedure.

in order to initiate the call setup, the MSC verifies that the requested service is allowed for the subscriber. This information is available in the Virtual Location Register, which maintains temporary subscriber data (location, preferences, allowed services). Once the VLR confirms the service requested by the originating MS, the MSC starts the call setup.

for the call to take place, the MSC allocates a voice channel between the MSC and the BSS. The BSS notifies the MS about the change to voice mode, and the MS returns a confirmation message. The MSC routes the call to the dialled number. When the call is received in the PSTN, the MSC is notified that the called subscriber is being alerted, at which point the originating MS receives a ring notification.

To disconnect the call by either party, a disconnect message is sent to the MSC, which releases the communication channels created with the PSTN and the BSS.

Mobile-terminated call

A terminated call (showed on the right side of the diagram above) in the GSM network is a call received on a mobile device. For an MT to be placed, it is necessary to locate the network to which the called subscriber is currently connected, and, once this is done, to route the call towards the destination MS.

when a call is placed from the PSTN towards a given phone number, the PSTN uses the information in the phone number (country and if available, operator) to locate gateway MSC leading to the MSC where the subscriber is registered.

the GMSC can request information about the subscriber's core network and current location by interrogating the HLR (Home Location Register).

the HLR constantly updates locations of the MS stored in the VLRs of the networks the MS visits. In the HLR, the subscriber MSISDN (phone number) is associated with the IMSI number of the SIM card, which was used to authenticate the subscriber in the visited network as they registered. Since authentication is communicated to the MSC, the HLR is aware of the visited MSC/VLR of the MS at a given time.

In order for the GMSC to pass the call to the MSC, the HLR asks a temporary roaming phone number from the MSC (Mobile Station Roaming Number - MSRN).

the MSRN is sent back from the HLR to the GMSC.

the GMSC forward the call to the MSC using the assigned MSRN.

having received the call, the MSC pages all the BSCs in the area that it serves.

the BSC, in turn, page the BTSs assigned to them.

the called MS responds to the paging from the BTS, asking to establish a radio channel to the BTS.

the response is forwarded to the MSC, which, once notified, authenticates the MS and initiates the ciphering of the call using the same procedure as in MO calls.

when the MSC sends back to the radio network the call confirmation message, the called MS starts to ring.

At the other end, the MSC notifies the GMSC, which notifies the PSTN that the destination number is being alerted.

Mobility and handover

Mobility and handover functions are required whenever MS location changes occur, and depend on whether the device is engaged in a call session (when handover is required) or not (mobility management). In GSM networks the location of a device is always known to the network and updated whenever necessary. Location updating is needed in the case an MS roams to a different location area. An MS is constantly listening to signals from the radio network (to detect whether it is paged for an incoming message) and in its turn communicates its location to the radio network whenever it enters a new location area. When not in a call, the MS connects to the cell that has the strongest signal, and when it detects a stronger signal from a different cell, it will disconnect from the current one and connect to the new one. If the MS moves to a new cell of the same location area, it is not necessary for it to reconnect (authenticate) to the network. If instead it goes into the range of a new Location Area, a location update procedure is initiated. Essentially, the MSC/VLR in the home network must register the new location so that the device can be available to other devices trying to send it a communication. Mobility procedures are shown in orange below:

to communicate to the network, the MS establishes the connection to the radio network, and sends a location update request to the current BSS. The BSS forwards the request to the MSC, which finds that the device was registered to a different MSC/VLR.

the current MSC contacts the previous MSC to get information about the MS, by sending it the Temporary Mobile Subscriber Identity.

in the old MSC, the IMSI is associated with the TMSI, so that the IMSI parameter is be sent to the new MSC. Once it reaches the MSC, the current location of the device is updated in the HLR; having the IMSI number, the HLR will be able to provide information about the subscriber (services allowed, preferences etc) to the new MSC.

the new VLR location is updated in the HLR. Information from the previous MSC/VLR is deleted.

once the updates are communicated by the HLR to the new MSC, authentication is performed using the SIM card IMSI. After authentication, the MSC initiates ciphering and allocates a new temporary identity that will be used to update the subscriber's next location.

If the MS is engaged in a call session and changes location, the connection must continue uninterrupted and transfer to the new location must be done seamlessly to the subscriber. If the MS roams from one BSC to a new one, both managed by the same MSC, the MSC will be the one managing the handover. As the BSC is informed by the MS of the location change, the BSC sends a handover request to the MSC, including the code of the current location area (LAC) and the cell identifier, which uniquely identifies the cell in the network. Once the MSC receives the coordinates of the new BSC, it messages it requesting the assignation of a speech channel. The MSC then sends a request to the current BSC to perform the handover to the new cell. The BSC sends the MS the new time slot and frequency requirements for the new channel.

A handover may also be requested between 2 different MSCs. This case scenario is illustrated in the diagram above in green color.

when the BSC is informed of the location change and finds that the new location is not in its area, it forwards the handover request to the MSC, which acknowledges that the subscriber has roamed to a different MSC. The MSC has access to the LACs of neighboring MSCs, therefore it can determine the network in which the subscriber has roamed.

the old MSC sends the request to the target MSC, which asks the corresponding BSC to establish the speech channel to the MS.

the MS receives handover request via the initially established channel;

communication is moved to the new created channel of the second MSC. The MSC that initially assigned the MSRN for setting up the call is called an anchor MSC and is responsible for all the inter-MSC handover procedures that may occur during a call.

in the case of a handover between different MSCs, a new authentication of the MS will also be performed in the new network.

Short Message Service

A short message service is handled in the network by the short message service center (SMSC) found in the core network, which is in charge of storing and routing messages between subscribers.

The process is illustrated in the diagram below.

to send an SMS, the MS connects to the MSC, which performs the authentication of the subscriber and ciphers the communication in the same way as in the case of voice calls.

after the MSC receives the message, it queries the VLR to check the allowed services for the subscriber.

if the service is allowed, the MSC forwards the message to the SMSC.

A mobile originated SMS contains information about the location of the SMSC that the SMS must reach, and about how to reach the destination subscriber. For the MS to identify the appropriate message center, information about it is configured in the SIM card by each network operator, so that the originating MS transfers it to the MSC.

the SMSC must find the destination MS address and identity in order to forward the message. It does so by using the phone number dialed by the originating MS, with which it locates the GMSC, to which it forwards the message.

the GMSC requests from the HLR information about the destination MS, available in the VLR/MSC where the subscriber is registered.

Like in the case of voice calls, the HLR uses the IMSI to locate the current MSC/VLR in which the subscriber has registered.

next, the HLR asks the MSC to assign a temporary MSRN number, which is passed to the GMSC.

the GMSC then forwards the message to the MSC using this number. The MSC sends out a paging to all the BSCs in its area, which then page all the base stations serving them.

the SMS is delivered to the MS after it responds to the BTS paging.

USSD (Unstructured Supplementary Service Data) allows an MS to communicate directly with the service provider's system in order to obtain various information in real time. Unlike SMS, USSD doesn't require a center to store and forward the message to the target party. Once the USSD message originated from the MS reaches the MSC, the MSC determines whether the service is authorized for the subscriber and if so, forwards the message either to a USSD gateway or to the HLR, depending on the requested service. The USSD gateway forwards the message from the GSM core network to the relevant application, which replies to the MS.

International roaming

Communication between two different mobile operators networks is possible based on the existence of roaming agreements between them. These can be direct bilateral agreements or, to simplify, agreements with a clearing house. An international transit network allows the exchanging of data between different operators, and its services are usually regulated by a clearing house, which acts as an intermediary between networks. It stores usage and call data records generated in the visited network, that are used for billing in the subscriber's home network. This way, an international roaming subscriber is allowed to use the services of the visited network but is charged by the home network.

Voice call flow

In GSM networks, when a call is placed from a visited network outside the MS home country, the call must go from the visited network to the home network of the called subscriber. If the subscriber has authenticated to the visited network, the location and user preferences will already be known to the v-MSC from the HLR. If a roaming subscriber receives a call, since the HLR knows the VLR/v-MSC where the MS is registered, it sends out a request to the visited MSC to assign the MSRN number to which the GMSC will then route the call. The MSRN is returned to the HLR, which sends it to the GMSC, which routes the call to the v-MSC. The MSRN contains the current visited country code and the current MSC code, so that the call can be routed accordingly to the MS.

Data transfer

In GPRS, a GPRS Roaming Exchange is used to connect network operators from different countries. Once the MS is attached to the visited core network, it sends a request for data access to the visited SGSN. The message includes the APN and the v-SGSN tries to locate IP address of the GGSN. Since it can't do that, it forwards the request to the GRX, which forwards it to the home DNS. The IP address of the home GGSN is identified and communicated to the v-SGSN, which then sends the PDP request to the home GGSN, which assigns the IP and the data transfer tunnel is created.

IMS network

In VoLTE calls, since the communication is sent in the network over IP protocols, an IP Exchange network, similar to the GRX in GSM/GPRS networks, is needed to ensure the communication channel. A Transit and Routing Function directs and anchors the route of SIP signals over the IP exchange. The P-CSCF adds the TRF address in the SIP Invite request sent to the I-CSCF of the home network. The I-CSCF is the first contact point in the home network, and its location is obtained using the DNS; the I-CSCF contacts the HSS to locate the S-CSCF location and forward it the request.The S-CSCF sends the request to the indicated TRF, which finds the destination operator and passes the invite to the S-CSCF.

SMS

International roaming MO SMS involves the message being routed through the home SMSC. The subscriber connects to the visited network and sends the SMS to the vMSC. Via the international exchange, the SMS is sent to the SMSC address which is configured in the MS. Using the destination address received from the originating MS, the SMSC queries the HLR to find the current location and network where the target MS is registered. After the SMS reaches the MSC, it is sent to the radio network and the subscriber receives the message.